Database
Critical WordPress vulnerabilities (page 50)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.2Update to 6.4.0
- Medium4.3Cross-Site Request Forgery
aThemeArt Theme Helper
≤1.0.8No patch available
- Medium5.3Missing Authorization
Passster – Password Protect Pages and Content
≤4.3.18Update to 4.3.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
Advanced Post Manager
≤4.5.6Update to 4.5.7
- Medium5.3Missing Authorization
YITH PayPal Express Checkout for WooCommerce
≤1.61.0Update to 1.62.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar
≤6.18.1Update to 6.18.2
- Medium5.3Missing Authorization
Bookit — Booking & Appointment Calendar
≤2.6.0.5Update to 2.6.0.6
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
SmartCrawl SEO checker, analyzer & optimizer
≤3.16.4Update to 3.17.1
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.26Update to 4.1.27
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium6.5Authenticated (Contributor+) SQL Injection
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium5.3Unauthenticated Information Exposure
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
≤1.4.54Update to 1.4.55
- High7.5Authenticated (Subscriber+) PHP Object Injection
Strong Testimonials
≤3.3.12Update to 3.3.13
- High7.3Unauthenticated Privilege Escalation
OTP Login With Phone Number, OTP Verification
≤1.8.77Update to 1.8.78
- Medium5.3Missing Authorization
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership
≤3.4.6Update to 3.4.7
- High8.1Unauthenticated PHP Object Injection
WPBot – ChatBot Conversational Forms
≤1.5.1Update to 1.5.2
- High7.5Unauthenticated SQL Injection
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.29Update to 1.0.30
- Medium5.3Unauthenticated Insecure Direct Object Reference
Electronic Signature Add-on for Fluent Forms
≤2.0.5Update to 2.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
PowerPack Lite for Beaver Builder
≤1.3.1Update to 1.3.2
- High7.3Unauthenticated Privilege Escalation
OttoKit: All-in-One Automation Platform
≤1.1.40Update to 1.1.41
- High7.2Unauthenticated Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium6.1Reflected Cross-Site Scripting
eStore
≤1.6.13Update to 1.6.14
- Medium4.3Missing Authorization
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
≤5.4.14Update to 6.0.0
- Medium5.3Missing Authorization
Site Reviews
≤8.3.4Update to 8.3.5
- Medium6.5Authenticated (Subscriber+) Arbitrary CSS Injection
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Critical9.8Unauthenticated Embedded Malicious Code
Rank Math SEO PRO
3.0.123 – 3.0.123Update to 3.0.124
- Medium5.31.2.9 - Unauthenticated Information Exposure
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.33.11.0 - Missing Authorization
Snap Finance
1.0.8 – 3.11.0Update to 3.12.0